Commit b3c4e4af authored by catch's avatar catch
Browse files

Issue #3526769 by mcdruid, smustgrave: Avoid abuse of config sync import tarballs 

(cherry picked from commit 0bb87cce)
parent 35fd22b0

core/modules/config/src/Form/ConfigImportForm.php

+6 −1
Original line number Diff line number Diff line
@@ -121,9 +121,14 @@ public function submitForm(array &$form, FormStateInterface $form_state) { 
        $archiver = new ArchiveTar($path, 'gz');

        $files = [];

        foreach ($archiver->listContent() as $file) {

          if (str_ends_with($file['filename'], '.yml')) {

            $files[] = $file['filename'];

          }

        }

        $archiver->extractList($files, $this->settings->get('config_sync_directory'), '', FALSE, FALSE);

        foreach ($files as $file) {

          $this->fileSystem->chmod($this->settings->get('config_sync_directory') . DIRECTORY_SEPARATOR . $file);

        }

        $this->messenger()->addStatus($this->t('Your configuration files were successfully uploaded and are ready for import.'));

        $form_state->setRedirect('config.sync');

      }

core/modules/config/tests/fixtures/not_just_config.tar.gz

0 → 100644
+280 B

File added.

No diff preview for this file type.

View file

core/modules/config/tests/src/Functional/ConfigImportUploadTest.php

+21 −0
Original line number Diff line number Diff line
@@ -70,4 +70,25 @@ public function testImport(): void { 
    $this->assertCount(1, $submit_is_disabled, 'The submit button is disabled.');

  }



  /**

   * Tests importing tarball with non-config contents.

   */

  public function testImportTarballFiltering(): void {

    $this->drupalGet('admin/config/development/configuration/full/import');

    $this->assertSession()->statusCodeEquals(200);



    $tarball = __DIR__ . '/../../fixtures/not_just_config.tar.gz';

    $edit = ['files[import_tarball]' => $tarball];

    $this->drupalGet('admin/config/development/configuration/full/import');

    $this->submitForm($edit, 'Upload');



    $sync_directory = Settings::get('config_sync_directory');

    $this->assertFileExists($sync_directory . DIRECTORY_SEPARATOR . 'config.one.yml');

    $this->assertFileExists($sync_directory . DIRECTORY_SEPARATOR . 'config.two.yml');

    $this->assertFileExists($sync_directory . DIRECTORY_SEPARATOR . 'executable.yml');

    $this->assertFalse(is_executable($sync_directory . DIRECTORY_SEPARATOR . 'executable.yml'));

    $this->assertFileDoesNotExist($sync_directory . DIRECTORY_SEPARATOR . 'script.sh');

    $this->assertFalse(is_executable($sync_directory . DIRECTORY_SEPARATOR . 'script.sh'));

  }



}